Detecting Fraud within 500 ms Using Flink on Amazon EMR with N26

Based in Germany, N26 offers Europeans a digital banking experience that is simple to use with minimal fees. N26 supports customers in 24 countries from a single code base, processing over 100 billion euros in transaction volume per year.

Fully digital banks need a high level of security to combat the anonymity of bad actors who no longer need to walk into a physical bank to process transactions or open accounts. Fraud detection solutions typically identify suspicious behaviors in near real time but analyze patterns and attempts the next day. With instant payment transfers and payments sent across borders increasingly becoming the industry standard, it’s much harder to stop transactions or recover funds after the fact.

To combat this challenge, N26 wanted to build a robust fraud detection solution that was accessible and user friendly for non-technical teams and could analyze behaviors in near real time for a more proactive, time-sensitive approach. “What we’ve observed in the industry is that bad actors keep changing and evolving patterns constantly and quickly,” says Rafael Roman, principal software engineer at N26. “The next-day industry standard wasn’t cutting it for us, and we wanted to do instant detection and analysis (less than a second) to facilitate safe instant payments for the bank and for our customers.”

N26 was already using AWS and started working with teams at AWS in October 2022 to reimagine its fraud detection solution. With support from the AWS prototyping team, N26 quickly built two prototypes and went through rigorous testing and approval processes before moving forward with an adaptable solution that would handle future fraud patterns as they evolved. In Q1 2023, N26 implemented Amazon EMR—a cloud-based big data solution for petabyte-scale data processing, interactive analytics, and machine learning using open-source frameworks—to deploy an Apache Flink application that processes all the information flowing through N26’s streaming solutions. The company started testing the fraud detection solution in March 2023 and had it running in production by June 2023. “We had an incredible response from AWS,” says Roman. “The team offered to meet to discuss the system and our requirements and suggest potential solutions. Customer service from AWS was highly engaged and dedicated and followed the company’s goal to always put the customer first.”

N26 has to decide within 500 ms whether to approve or deny a transaction for instant payments. With its solution built on AWS and other company initiatives, N26 significantly addressed fraud in 2023, reducing it by 80 percent overall in a single year. N26 reduces the time it takes to detect a new fraud pattern because its solution looks for suspicious behaviors every time a transaction occurs. The company can then block these accounts and remove fraudulent users promptly. “As we see patterns of fraud evolving, we can change the parameters and tweak the patterns in our solution built on AWS to get better results,” says Roman.

Because the solution is highly configurable, N26 can adjust rules to increase accuracy and reduce the incidence of false positive alerts that then require operational capacity to investigate. N26 also uses artificial intelligence and machine learning algorithms to reduce the number of false positives based on analysis of historical data. “We can change parameters much more easily than we could before,” says Roman.

Using AWS, N26 also reduced the complexity of its solution and empowered employees without a technical background to use the solution. Fraud analysts who understand industry trends can analyze data and deploy new rules that automate the detection of suspicious activity in a matter of days. Using Apache Flink, N26 also relies less on the data engineering team and data warehouse workloads that aren’t designed for large operational workloads. N26 plans to continue innovating and applying its infrastructure built on AWS to new use cases for near-real-time decision-making, such as faster approval for loan applications. “The whole world is becoming faster, more connected, and more online,” says Roman. “People expect these capabilities from their bank, and our technology built on AWS helps us move faster and at a lower cost.”

N26 plans to continue adapting to the changing needs of the banking industry. For example, to further simplify its infrastructure and reduce maintenance, the company is migrating some of its data workloads from Amazon EMR to Amazon Managed Service for Apache Flink, which organizations use to build and run fully managed Apache Flink applications. “We have a philosophy of constant exploration,” says Stephen Lagraulet, director of engineering at N26. “Working on our solution built on AWS helps progress our knowledge and understanding of what the best technology will be for our evolving needs.”